Court Holds OPM DOGE Access Unlawful, Rejects Ultra Vires Claim, No Remedy Yet

Court Holds OPM DOGE Access Unlawful, Rejects Ultra Vires Claim, No Remedy Yet

A federal judge in Manhattan ruled on October 20, 2026 that the Office of Personnel Management broke the Privacy Act when it handed DOGE-affiliated staff sweeping access to records on tens of millions of federal workers. What happens next is undecided.

Information last verified on October 23, 2026. This is a developing story; we update it as the record changes.

Status: Summary judgment issued on October 20, 2026. Judge Denise Cote granted the plaintiffs' cross motion for summary judgment on their Administrative Procedure Act claims and granted the defendants' motion for summary judgment on the plaintiffs' ultra vires claim, denying the rest of the defendants' motion. This ruling entered no new injunction and ordered no party to do anything. It neither dissolves nor extends the preliminary injunction entered in June 2025; the opinion says only that the preliminary injunction does not establish whether permanent injunctive relief is appropriate. It wrote that the scope of relief, if any, will be addressed by separate order, and that it will solicit the parties' views on what relief, if any, is appropriate. Remedy is reserved pending further briefing.

Jurisdiction scope: This article covers one federal district court ruling from the Southern District of New York applying the federal Privacy Act of 1974 and the Administrative Procedure Act to a federal agency and its records. It does not address state consumer privacy statutes, private-sector data handling, or monitoring by private employers. For the state-level consumer side of data privacy, see data broker registration and deletion rules.

What Happened

On October 20, 2026, United States District Judge Denise Cote filed a 39-page Opinion and Order, Document 241, in American Federation of Government Employees, AFL-CIO, et al. v. U.S. Office of Personnel Management, et al., No. 1:25-cv-01237-DLC (S.D.N.Y.). The court granted the plaintiffs' April 15, 2026 cross motion for summary judgment on their Administrative Procedure Act claims. It granted the defendants' March 20, 2026 motion for summary judgment on the plaintiffs' ultra vires claim and denied that motion in all other respects. The substantive holding is that OPM's decision to give a group of individuals associated with the Department of Government Efficiency broad access to its systems of records containing personally identifiable information, without a demonstrated need, was unlawful. The court entered no injunction. It wrote that the scope of relief, if any, will be addressed by separate order.

The case was filed on February 11, 2025 by current and former federal employees and their unions, represented by the Electronic Frontier Foundation, Lex Lumina LLP, the Democracy Defenders Fund and The Chandra Law Firm. The complaint pleaded five claims: two under the Privacy Act of 1974, two under the APA, and one ultra vires claim. There are two sets of defendants, which the opinion calls the OPM Defendants and the DOGE Defendants.

The opinion opens with the court's own summary of the conduct at issue:

“Following President Trump's inauguration on January 20, 2025, the U.S. Office of Personnel Management ("OPM") granted a group of individuals associated with the Department of Government Efficiency ("DOGE") broad access to systems of records containing the personal information of tens of millions of past, current, and aspiring federal employees, even though no credible need for this access had been demonstrated. In doing so, OPM violated the law and bypassed its established cybersecurity practices.” AFGE v. OPM, No. 1:25-cv-01237-DLC (S.D.N.Y. Oct. 20, 2026), Doc. 241, at 2

The access, by the opinion's own numbers

Read the figures as the court states them, because they are easy to garble. Beginning on January 20, 2025, OPM gave individuals working on the DOGE agenda access to at least fourteen OPM systems, most of which contain personally identifiable information. OPM ran two early internal reviews, which the opinion calls the February Audit and the March Audit, and which the court notes are inconsistent with each other.

According to the March Audit, twenty DOGE-related individuals were granted access to OPM systems during the period January 20 to March 6, 2025. Almost all of that access was administrative access, which the court said violated the cybersecurity principle of least privilege.

Of those twenty, the opinion says three were in leadership positions at OPM: Charles Ezell, the Acting Director; Gregory Hogan, the Chief Information Officer; and Amanda Scales, Chief of Staff to the OPM Director. A further seven, whom the June 2025 opinion called the Group of Seven, tended to have technology-industry backgrounds, and the court observed that some were unusually young and inexperienced and that most appeared not to work solely or even primarily for OPM. The record contains relatively little information about the remaining ten, called the Group of Ten.

DOGE Agents also obtained OPM data indirectly, through career OPM staff, rather than only by logging in themselves. The opinion gives the example of government email addresses and employee names being extracted by career staff and made available to DOGE Agents for a government-wide email service.

Two details carried particular weight. First, the court found that few of the relevant individuals ever logged in to OPM systems at all, despite holding administrative access. Second, OPM's then-CIO testified that a request for access could be satisfied within minutes, which undercut any argument that access had to be granted in advance. Statements by Ezell and Hogan indicated that access had been granted in anticipation that it might be needed, and the court held that anticipation does not qualify as a showing of need under the Privacy Act.

The opinion also records that career database administrators in OPM's Office of the CIO had their own access revoked on or shortly after January 20, 2025, and that Hogan directed on February 6 that it be immediately restored. Many DOGE Agents acknowledged completing OPM's Cybersecurity and Privacy Awareness Training only weeks after they had already been given access.

What has changed since

By the date the preliminary injunction was entered, June 20, 2025, eight DOGE Agents remained at OPM, four of whom still held mostly administrative-level access to certain systems containing PII. The opinion names them as Akash Bobba, Nihkil Rajpal, Riccardo Biasini and Gavin Kilger. The court notes that OPM repeatedly removed access permissions shortly before reports were due in the litigation, and that no DOGE Agent has had access to OPM systems containing PII since September 2025.

The headcount then fell: five DOGE Agents as of the government's December 5, 2025 mootness motion, two when summary judgment briefing began on March 20, 2026, and one after Riccardo Biasini left on July 23, 2026. The remaining individual is Noah Peters, appointed on January 20, 2025 as a Senior Advisor in OPM's Office of the Director. He had access to systems containing PII from January 24, 2025 and no longer had it as of June 20, 2025. The opinion notes he did not complete OPM's cybersecurity training until April 5, 2026, nearly fourteen months after the case was filed. Whether Peters was an OPM employee or a detailee from USDS during the relevant period is disputed on the record.

OPM also changed its rules twice during the case. A revised Cybersecurity and Privacy Policy was approved on November 18, 2025 and announced to staff on November 20, days before the government's mootness motion was due. It was revised again on May 11, 2026, during summary judgment briefing, to confirm that only OPM employees and contractors, not detailees, may be granted access, and that the protocols apply to indirect access as well as direct access. OPM's current CIO repudiated the "need to be prepared" justification for administrative access in a July 6, 2026 declaration, then extended that repudiation to all grants of access in a July 28 declaration after the plaintiffs pointed out the gap.

Why the case is not moot

This is the subtlest part of the ruling, and it cuts in two directions at once.

The court held the case is not moot. Voluntary cessation carries what the Supreme Court called a "formidable burden" in FBI v. Fikre, 601 U.S. 234, 241 (2024), and the government did not carry it. The court gave three reasons: OPM continues to maintain that the DOGE Agents who received access were employees who had a need for it; the timing of OPM's policy revisions closely tracks the litigation's deadlines, which the court said suggests they were driven more by a desire to resolve the case than by a genuine change of course; and Peters remains at OPM with only a commitment that access will not be granted except in conformity with policy and law. The court gave particular weight to the fact that the DOGE Temporary Organization's July 4, 2026 end date was fixed by Executive Order 14158 rather than adopted in response to this litigation, and found that its termination narrows, but does not eliminate, the circumstances in which the challenged conduct could recur.

The court credited OPM's "admirable efforts during this litigation to strengthen its protocols," but it called the agency's behavior "undoubtedly commendable" only in the course of finding that the behavior "appears designed" to avoid judicial review, and it observed that "it is ultimately no more difficult for OPM to ignore these new protocols than to ignore its old procedures."

Having found the case alive, the court then separated that question from the remedy question:

“Whether a case is moot and whether an injunction should issue, however, are "analytically distinguishable" questions governed by different burdens.” Doc. 241, at 33

To obtain an injunction, the opinion continues, the burden is on the plaintiff to show that relief is needed, which requires some cognizable danger of recurrent violation, something more than the mere possibility that keeps a case alive. So the developments since 2025 fell short of mooting the case, but whether they defeat the request for a permanent injunction is a separate issue the court has not yet decided.

What the Law Actually Says

The statute at the center of this case is the Privacy Act of 1974, 5 U.S.C. § 552a. It governs how federal agencies collect, keep and disclose records about individuals. It is not a general consumer privacy law. It does not give you a claim against a bank, an employer in the private sector, or a social media company. Readers arriving from a search for "privacy act" should know that at the outset.

The Act is built around a defined term. Under § 552a(a)(5):

“the term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual”

That is why the opinion keeps saying "systems of records containing PII" rather than simply "databases." The Act attaches to collections of records that are actually retrieved by a personal identifier.

The disclosure rule, § 552a(b)

Subsection (b) is a prohibition with a list of exceptions. Its opening words:

“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be ...”

Twelve numbered exceptions follow. The first of them, § 552a(b)(1), is the one the whole case turns on:

“to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties”

Two conditions sit inside that short clause, and both must hold. The person must be an officer or employee of the agency that maintains the record, and that person must have a need for the record in the performance of their duties. The court read the second condition as tied to duties actually being performed, not to duties an employee might conceivably be assigned later. Granting access in case it might one day be needed does not satisfy it.

The safeguards rule, § 552a(e)(10)

The second provision requires each agency to:

“establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained”

The court found OPM set aside safeguards it already had, including the training requirement and the cybersecurity principle of least privilege, in connection with the individuals brought in to pursue the DOGE agenda.

Why the win came under the APA, not the Privacy Act

The plaintiffs pleaded two standalone Privacy Act claims, but an earlier Opinion of April 3, 2025 dismissed them except insofar as they serve as a predicate to the other claims. The vehicle that survived is the Administrative Procedure Act. Under 5 U.S.C. § 706(2)(A), a reviewing court must "hold unlawful and set aside agency action, findings, and conclusions found to be ... arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law."

The opinion relies on the final prong of that list. Because OPM's grants of access violated §§ 552a(b) and (e)(10) of the Privacy Act, they were "not in accordance with law," and the APA claims succeeded. The court did not rest the holding on the arbitrary-and-capricious prong.

The ultra vires claim went the other way. Non-statutory ultra vires review is a narrow doctrine, and under NRC v. Texas, 605 U.S. 665, 682 (2025), it is unavailable where a statutory review scheme already gives aggrieved persons a meaningful and adequate opportunity for judicial review. The APA did that here, so the defendants won summary judgment on that claim. The plaintiffs had not moved for summary judgment on it themselves.

If you are trying to place these statutes among the other federal privacy rules, the site's overview of the main federal electronic privacy statutes covers the separate ECPA and Stored Communications Act framework, which governs interception and stored communications rather than agency recordkeeping.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most useful thing about this opinion is not that a federal agency lost. It is the specific definition of "need" the court refused to loosen.

The government's theory, drawn in part from a Fourth Circuit panel decision in Am. Fed'n of Tchrs. v. Bessent, was that an employee with broad and open-ended duties may need correspondingly broad access to an employer's systems. The court did not reject that premise outright. It said that even accepting it, need still depends on the duties actually being performed, and that the record contained no contemporaneous explanation connecting any DOGE Agent's duties to the access granted. That is a documentation standard as much as a legal one. An agency that cannot point to a contemporaneous, duty-specific justification in its own record has nothing to defend with later.

Worth flagging for anyone following the appellate picture: the opinion notes that the Fourth Circuit panel decision the government relied on was vacated by that court sitting en banc in 2026. The law in this area is genuinely unsettled above the district court level, and this is one district judge's ruling, not a controlling national rule.

The second notable feature is structural. The court declined to let fixing the problem erase the finding that there was one. Voluntary cessation has to clear a formidable burden precisely so that a defendant cannot moot away an adverse ruling by changing course once litigation gets uncomfortable. The court's observation that OPM removed access permissions shortly before court reports were due, and revised its policies days before filing deadlines, is the kind of pattern that doctrine exists to notice.

At the same time, the court was unusually candid about the limits of procedure as a fix. It wrote that the misconduct was not attributable to deficient procedures or a lack of clarity about the law, but to the failure of particular individuals to abide by the Privacy Act and honor safeguards already in place. That is a pointed observation about compliance generally: a rule nobody is willing to follow is not improved by rewriting it.

Finally, read the remedy posture honestly. A holding that conduct was unlawful is not an order. The access permissions are already rescinded, so there is nothing left to vacate or set aside, and the court said explicitly that the June 2025 preliminary injunction does not establish whether permanent injunctive relief is appropriate. We are not going to guess what the court will do, and no reader should treat this ruling as having secured anything concrete yet.

What Happens Next

The court will solicit the parties' views on what relief, if any, is appropriate. The opinion's final paragraph before its conclusion encourages the parties, in the meantime, to confer and explore whether they can reach an agreement on an appropriate resolution. The scope of relief, if any, will be addressed by separate order.

The court set out the standard it will apply. Citing Friends of the Earth, Inc. v. Laidlaw Environmental Services (TOC), Inc., 528 U.S. 167, 193 (2000), it noted that voluntary cessation may be insufficient to establish mootness but remains an important factor in deciding whether an injunction is warranted. It also said it must independently assess what, if any, permanent injunctive relief is warranted in light of the record now before it, including material developments since the preliminary injunction was entered.

Settlement has been on the table before. A defense letter of June 16, 2026 asked for more time to finalize a settlement and represented that the parties had reached agreement on all issues except fees, costs and expenses. The government then filed its opposition brief on July 7 instead, and the case proceeded to decision.

Two outside reviews touching DOGE access at OPM were still pending as of the summary judgment briefing: one by the Government Accountability Office and one by OPM's Office of the Inspector General. The court separately noted that OPM's own annual FISMA audit, dated November 24, 2025, does not mention the broad grants of access at issue here.

We will update this article when the court rules on what relief, if any, is appropriate, when the parties file their positions on remedy, or if an appeal is noticed.

How This Affects You

This ruling does not award anything to any individual federal employee. It decided the legality of an agency decision, and the two standalone Privacy Act claims in the case had already been dismissed except as predicates to the APA claims. If you are a current, former or prospective federal employee whose records are held by OPM, the ruling describes conduct the court found unlawful; it does not, by itself, create a payment, a notification right, or a claim you can file.

If you want to know what a federal agency actually holds about you, the Privacy Act and the Freedom of Information Act run on parallel request tracks, and agencies routinely process requests under both. Our walkthrough on making a records request to a federal agency covers the mechanics, and the state-by-state public records overview explains how the state equivalents differ.

If you are a federal employee who believes an agency is mishandling records, internal and statutory reporting channels are a separate track from litigation like this one. Our summary of reporting protections available to government workers explains which channels exist and what they do and do not protect.

If you work in the private sector, none of this applies to your employer. The Privacy Act binds federal agencies only. Private-sector data handling is governed by state consumer privacy statutes, sector-specific federal laws, and contract.

This is general legal information, not legal advice. It covers a single federal district court ruling from the Southern District of New York interpreting the federal Privacy Act of 1974 and the federal Administrative Procedure Act, and it reflects sources verified on October 23, 2026. It does not address state privacy statutes or private-sector obligations. Laws change, this ruling has not resolved remedy, and the story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Federal recording and electronic privacy statutes
• How to file a records request with a federal agency
• Public records laws in all 50 states
• Reporting protections for government workers
• Data broker registration and deletion rules

---

Last updated: 2026-10-23. This is a developing story; details verified as of 2026-10-23.

Frequently Asked Questions

Did the court order OPM to do anything on October 20, 2026?

No. The ruling decided liability only. The court entered no injunction and ordered no party to do anything. It wrote that the scope of relief, if any, will be addressed by separate order, and said it will solicit the parties' views on what relief, if any, is appropriate. Treat the remedy as undecided.

What exactly did the court decide?

In American Federation of Government Employees, AFL-CIO v. U.S. Office of Personnel Management, No. 1:25-cv-01237-DLC (S.D.N.Y. Oct. 20, 2026), Judge Denise Cote granted the plaintiffs summary judgment on their Administrative Procedure Act claims, holding that OPM's grant of broad access to DOGE Agents violated 5 U.S.C. § 552a(b) and § 552a(e)(10) of the Privacy Act and was therefore not in accordance with law under 5 U.S.C. § 706(2)(A). She granted the defendants summary judgment on the plaintiffs' ultra vires claim and denied the rest of their motion.

So who won?

Both sides won something. The plaintiffs won the merits ruling on their APA claims, which is the substantive holding that OPM acted unlawfully. The defendants won summary judgment on the ultra vires claim, because under NRC v. Texas, 605 U.S. 665 (2025), that narrow doctrine is unavailable where the APA already provides meaningful review. Nobody has yet won any relief.

Does the Privacy Act of 1974 give me rights against a private company?

No. The Privacy Act, 5 U.S.C. § 552a, governs how federal agencies handle records about individuals. It does not regulate private employers, banks, retailers or technology companies. Private-sector data handling in the United States is governed by state consumer privacy statutes and sector-specific federal laws instead.

What is a “system of records” under the Privacy Act?

Section 552a(a)(5) defines it as a group of any records under the control of any agency from which information is retrieved by the name of the individual, or by some identifying number, symbol or other identifying particular assigned to the individual. The definition matters because the Act's disclosure limits attach to records held in such a system, not to every file an agency happens to keep.

Is the case over, and can it be appealed?

The case is not over. The court has reserved on remedy and will address the scope of relief, if any, by separate order, after soliciting the parties' views. The opinion notes that the defendants incorporated several prior arguments specifically to preserve them for appeal. As of October 23, 2026 we have not verified any notice of appeal on the docket.

Does this ruling mean the data was stolen or leaked?

The opinion does not make such a finding. It recounts a declaration from OPM's current Chief Information Officer describing an internal investigation run between May 18 and June 5, 2026 which, in his account, did not reveal evidence that DOGE Agents exported, copied, transferred or transmitted records containing the plaintiffs' personal information outside OPM systems. The court recounted that evidence in its factual background; the holding does not rest on it, and the opinion makes no independent finding about what happened to any data.

How many people were given access, and to what?

Per OPM's March 2025 audit as described in the opinion, twenty DOGE-related individuals were granted access to OPM systems between January 20 and March 6, 2025, and almost all of that access was administrative access. At least fourteen OPM systems were involved, most of which contain personally identifiable information. The court also found that DOGE Agents obtained data indirectly through career OPM staff, and that few of the individuals ever logged in despite holding administrative access.

Does this decision apply outside New York?

It is a decision of one federal district court, the Southern District of New York, and it is not binding on other courts. It interprets federal statutes that apply nationwide, so its reasoning may be persuasive elsewhere, but the opinion itself notes that a Fourth Circuit panel decision the government relied on was later vacated by that court sitting en banc, which is a sign the appellate law here is unsettled.